Electric and electronic components in an automotive vehicle which are operated, or actuated under certain circumstances, by means of an electric voltage may be destroyed when they are acted upon by a too low or too high voltage. In order to compensate for voltage variations in the electrical system of an automotive vehicle, it is known in the art to make available a regulated output voltage and to monitor the level of the output voltage by means of a comparator. With this regulated output voltage, the voltage of the electrical system is adjusted to a defined value by way of a reference voltage.
Where the objective is to integrate the circuit element for generating the regulated output voltage with other circuit elements jointly in one chip, another problem involves the possible destruction of the chip itself due to a wrong output voltage.
This is critical especially in systems which are important for driving safety because, in case of an error, a proper disconnection of the system must be ensured in order to permit activation of a defined emergency operation mode. This applies to ABS/TC (traction slip control) systems, for example.
U.S. Pat. No. 5,648,759 A describes a circuit arrangement for voltage monitoring wherein two reference voltages are used. The first reference voltage is used to regulate the output voltage.
The output voltage is monitored by means of a second reference voltage or a voltage zone between a top limit value and a bottom limit value. Both reference voltages are taken from one single electronic reference voltage source.
Therefore, an object of the present invention is to increase the fail safety of systems of this type.
According to the present invention, this object is achieved by the circuit arrangement of the present invention, wherein the circuit element for regulating the output voltage and the circuit element to monitor whether threshold values have been exceeded or have fallen short of are integrated in one chip, and wherein further the adjustment of the output voltage is effected by way of a first reference voltage, and wherein monitoring of the threshold values as to whether they have been exceeded or have fallen short of is conducted by way of a second reference voltage.
Advantageously, this improves the reliability in detection of an error. It can be detected when any one of the two reference voltages adopts wrong values. In case the first reference voltage is incorrect, there will occur a wrong regulated output voltage, corresponding to the incorrect first reference voltage, which can be detected by means of the second reference voltage. It is then possible to perform error handling when a discrepancy between the regulated output voltage and the second reference voltage is detected. In case the second reference voltage is incorrect, admittedly, the regulated voltage will still adopt the correct values. However, there will nevertheless occur a difference between the regulated output voltage and the second reference voltage, for what reason error handling is carried out also in this case.
This proves favorable compared to a circuit arrangement wherein the regulated output voltage is produced with the same reference voltage which is used to check in a comparator whether the regulated output voltage has adopted the correct value. In case the reference voltage drifts away, the thresholds of the comparator will change in the same sense as the regulated output voltage so that the error will not be noticed. In the present case of application described herein, this may be especially critical for the reasons indicated above. Thus, fail safety will be increased because an error case can be detected before components, in particular components which are critical under safety aspects, will possibly be destroyed.
It is especially advantageous when also the driver stages for the consumers, such as the valve drivers in an ABS/TC system, are jointly integrated in the chip.
In a preferred embodiment of the circuit arrangement, the first reference voltage is used in order to check the regulated output voltage.
This permits detecting, for example, whether the voltage regulation operates incorrectly with a correctly predetermined first reference voltage. This provision permits further improvement of the detection of potential errors and, hence, further enhancement of the fail safety of this system.
Preferably, another electronic circuit is supplied with the output voltage, and this circuit is monitored by means of a watchdog circuit element integrated in the chip of the circuit arrangement, with the oscillator of the watchdog circuit element being supplied with the second reference voltage.
It may be ensured by this embodiment in particular that the further electronic circuit is checked in the circuit arrangement by making use of the second reference voltage. This means if an incorrect voltage is supplied to the further electronic circuit due to an incorrect first reference voltage, this circumstance can be detected in the signals sent by the further electronic circuit to the watchdog circuit. In case no more signals are sent, this will of course be detected by the watchdog circuit as well.
When an error is detected by the watchdog circuit element, driver stages for external consumers will be disconnected in the embodiment of the circuit arrangement according to claim 4.
This proves especially favorable when these driver stages are integrated in the chip. Destruction of the chip is reliably prevented due to this provision. Also, it is possible to switch the system over into an emergency operating mode.
Still, in another embodiment a driver stage to switch on alarm lamps is activated when an error is detected by the watchdog circuit element.
This makes it easy to recognize an error and a consequent disconnection of the system.
Further, checking of the output voltage by means of the first reference voltage is carried out by a comparator which is integrated in the chip of the circuit arrangement, and the microprocessor is reset as soon as the comparator detects that a defined threshold value has been exceeded or has fallen short of.
This renders it possible in a simple fashion to conduct a checking operation with the first reference voltage without increased circuit structure. When this first reference voltage, in the capacity of a comparison voltage with regard to the regulated output voltage, is applied to the input of the comparator, and the output of the comparator is applied to a reset input of the microprocessor, the microprocessor will be reset as soon as the comparator detects an inadmissible difference between the regulated output voltage and the first reference voltage. The microprocessor is then reset by way of the reset input of the microprocessor. Signals are no longer sent to the watchdog circuit element due to this reset of the microprocessor so that a case of error is detected by the watchdog circuit element of the circuit arrangement. This watchdog circuit element (furnished with the second reference voltage) is used to initiate the respective further measures, such as the disconnection of the driver stages of consumers and the activation of a driver for actuating alarm lamps.
This means that detection of an error situation with a deactivation of the system (reset of the microprocessor, deactivation of consumers) can be performed with little circuit structure needed.
In yet another embodiment, the output voltage of the controller is supplied to an input of a comparator whose other input is furnished with the second reference voltage, and it is monitored by means of the comparator whether a defined threshold value of the output voltage has been exceeded or has fallen short of.
The result is that the level of the output voltage is directly compared to the second reference voltage.
Driver stages for external consumers are disconnected when a comparator detects that the defined threshold value has been exceeded or has fallen short of.
This proves particularly favorable when these driver stages are integrated in the chip. Destruction of the chip is reliably prevented by this measure. Besides, the system can be switched over into an emergency operating code.
Preferably, a driver stage for switching on alarm lamps is activated when a comparator detects that the defined threshold value has been exceeded or has fallen short of.
This permits easily recognizing an error and disconnection of the system caused thereby.